Global Spies Use ZipperDown and Android Zero-Days for 1-Click Email Client RCE and Account Takeover

According to RedDrip, the RedDrip team at QiAnXin Threat Intelligence Center released a report detailing a multi-year series of zero-day exploitation campaigns by Advanced Persistent Threat actors operating from Northeast Asia, targeting both desktop and Android environments in espionage operations.

The analysis notes that attackers have achieved 1-click, and likely 0-click, capabilities against Android email clients, with some zero-days used against government and enterprise targets but most campaigns aimed at individuals around the Korean Peninsula. The report highlights the first known in-the-wild exploitation of the ZipperDown vulnerability (initially discovered by Pangu Lab in 2018), with claims that the RedDrip team is the first to disclose in-the-wild APT exploitation of this flaw.

Payload transitions are traced from 2022–2023 to 2024–2025, evolving from backdoors in a modified libttmplayer_lite.so to a module libpanglearmor.so that downloads an APK trojan and transmits command results and device data. The campaign enables password-less account takeover by theft of tokens and configuration files, allowing attackers to access emails, contacts and other sensitive data.

RedDrip’s assessment underscores geopolitical complexity and warns that such 0-day espionage activities likely indicate a broader escalation in national-level cyber warfare.